Changeset 53092

Timestamp:

04/07/2022 12:52:32 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Restore the correct escaping function for base64-encoded SVG icons in the admin menu.

Add a comment to clarify the esc_attr() usage instead of esc_url().

Follow-up to [53050].

Props KProvance, kebbet, w33zy, ocean90, mukesh27.
Fixes #55539.

File:

• trunk/src/wp-admin/menu-header.php (modified) (1 diff)

trunk/src/wp-admin/menu-header.php

@@ -129 +129 @@
                 $img = '<br />';
             } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
-                $img       = '<br />';
-                $img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
+                $img = '<br />';
+                // The value is base64-encoded data, so esc_attr() is used here instead of esc_url().
+                $img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
                 $img_class = ' svg';
             } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {